Threats Tagged 'ghsa-v6r2-jh58-xx6w'

OpenClaw's marketplace runtime extension metadata in versions prior to 2026.5.18 could reference unscanned payloads, allowing a trusted operator's selected package to redirect runtime loading to hidden content that bypasses expected scanning. This vulnerability affects the specific feature and configuration related to runtime extension metadata and does not alter the trusted-operator security model. The impact depends on the operator's configuration and whether lower-trust inputs can access the vulnerable path. The issue is patched in version 2026.5.18. Until patched, mitigation includes installing only trusted plugins, maintaining explicit plugin allowlists, narrowing channel and tool allowlists, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.